topic Adding - when you "image" the in Network Security

Adding SSD to ASA 5555X or 5525X - general questions

kbyrd — Tue, 12 Mar 2019 05:16:56 GMT

I am prep'ing two HA pairs of ASAs for FirePOWER. I have (hot) installed the SSDs (two in 5555X and one in 5525X) and did not see the SSDs in SHOW INVENTORY. Upon reading the instructions in the ASA hardware guide, it says that you must reload the ASA to recognize the SSD. I reloaded the non-active 5525X and the SSD still did not show up in SHOW INVENTORY.

Questions:

1) when you install the SSD, is the old non-SSD drive still active? (Yes, because the non-active ASA reloaded with no problem, but please verify)

The instructions say to "image" the SSD. My thought was that the FirePOWER image would be the only image I would put on the SSD and I would continue to use the non-SSD for other files like the ASA and ASDM images.

2) Can you use both the non-SSD and SSD drives in a single ASA?

3) Do I need to move the files from the non-SSD to the SSD? From the instructions, it seems both are referred to as DISK0: so I'm not sure how to reference both drives individually. How would I load the FirePOWER image onto the SSD if both non-SSD and SSD are referenced as Disk0:?

The SSDs lights are illuminated after the drives were installed.

Thanks.

1. The base storage on an ASA

Marvin Rhoads — Tue, 30 Dec 2014 04:40:17 GMT

1. The base storage on an ASA (both legacy and X series) is a compact flash (CF) card, designated "disk0" on the ASA. The solid state drive (SSD) is in addition to - not instead of - disk0.

2. As noted above - you can (and indeed you must).

3. The SSD is not user-adressable or -accessible storage. It is used for storage by the module (sfr or cx). No file manipulation or other operations referencing the SSD directly are required of the either the user or administrator.

Adding - when you "image" the

Marvin Rhoads — Wed, 31 Dec 2014 16:43:38 GMT

Adding...

... when you "image" the sfr module, it is using a special boot image on disk0 compact flash card. That boot image bootstraps the SSD and the full FirePOWER module image is later loaded into and installed, making the "sfr" module fully functional (i.e. up status and ready to be setup and registered with a Firesight Management Center)

Marvin, thank you for your

kbyrd — Wed, 31 Dec 2014 16:56:45 GMT

Marvin, thank you for your detailed reply.

TAC is saying that the SSD should show up in SHOW INVENTORY, however they are saying that because the legacy IPS is enabled, that may be affecting the display of the SSD.

You're welcome.That could be

Marvin Rhoads — Wed, 31 Dec 2014 17:00:09 GMT

You're welcome.

That could be - I know in the ASA with FirePOWER lab guide we were instructed to uninstall the legacy IPS module (image / application) when we find it in existence as a prep step for the sfr module. While that shouldn't per se affect the hardware inventory displayed, it could be a bug in that respect.

Marvin, one last question, do

kbyrd — Wed, 31 Dec 2014 17:02:32 GMT

Marvin, one last question, do you know if a minimum ASA firmware version is required to recognize those SSD? I'm running 9.01 and 9.02 on the two ASAs. All I can find in the release notes related to SSD is that v9.1.1 is required for the ASA CX SSP software module - which requires the SSD.

I do believe ASA 9.1(1) is

Marvin Rhoads — Wed, 31 Dec 2014 17:19:35 GMT

I do believe ASA 9.1(1) is required as a minimum. See the matrix in Table 3 in the ASA compatibility matrix.

Also the release notes for ASA 9.1 note under "New Features in ASA 9.1(1)" that they introduced support for the SSD-based CX SSP.

You have to move up to at least 9.2(2.4) for for FirePOWER Service module.

I upgraded to 9.2.2.4 last

kbyrd — Mon, 19 Jan 2015 15:27:21 GMT

I upgraded to 9.2.2.4 last evening (from 9.0(4)) and the SSD appears in the display for SHOW INVENTORY: (serial numbers masked).

C5525X-P10-DMZ# sh inv
Name: "Chassis", DESCR: "ASA 5525-X with SW, 8 GE Data, 1 GE Mgmt, AC"
PID: ASA5525 , VID: V01 , SN: xxxxxxxxxxxx

Name: "Storage Device 1", DESCR: "Model Number: Micron_M550_MTFDDAK128MAY"
PID: N/A , VID: N/A , SN: xxxxxxxxxxxx

Thanks again for Marvin's responses.

If you are using dual SSD

gamoore — Fri, 24 Jul 2015 19:52:23 GMT

If you are using dual SSD drives, how and where does the Raid 1 configuration take place?

When you image the module for

Marvin Rhoads — Fri, 24 Jul 2015 19:58:08 GMT

When you image the module for the first time in an ASA that is being upgraded to include the dual SSD, the RAID configuration will happen automatically as part of the imaging process. There are no user configurable options in that regard.

Marvin,thanks, worked just as

gamoore — Fri, 31 Jul 2015 05:40:47 GMT

Marvin,thanks, worked just as you said.

I know this thread is little

jwornstaff — Tue, 22 Mar 2016 17:54:52 GMT

I know this thread is little old but hoping to piggy back a question. I am going through the same process i.e. upgrading ASA IPS module to firepower. Should I remove the IPS module before install the new SSD, as I currently do not have SSD installed. Or will it mater?

Thanks!

Give us a few more details

Marvin Rhoads — Tue, 22 Mar 2016 18:15:34 GMT

Give us a few more details please. The (sanitized) output of the following would do it:

show  inventory
show module
show version

Not sure why all the outputs

jwornstaff — Wed, 23 Mar 2016 10:45:49 GMT

Not sure why all the outputs needed, not looking for the technical implementation details and beside can't do that.

Was just looking for the order of operations.

1. Install new SSD drive.

2. Remove IPS Software module

3. Install SFR software module

1. Remove IPS software module

2. Install new SSD drive

3. Installs SFR software module

The output is requested in

Marvin Rhoads — Wed, 23 Mar 2016 13:02:43 GMT

The output is requested in order to give as accurate an answer as possible. I have found over years of experience that I am not safe in assuming anything about the customer's environment since there is so much variation.

Seeing the exact equipment model (show inventory), the installed modules and their status (show module) and verifying the prerequisite version required to support a FirePOWER module (show version) all guide an accurate response.

That being said, assuming you have a 5500-X series ASA with a software IPS module installed, the order of items 1 and 2 in your list do not matter. Installing the SSD must be done while the ASA is powered off, so I would normally uninstall the IPS module first, shutdown the ASA, install the SSD and then bring the ASA back online. If you have ASA 9.2(2.4) or later (required for sfr module) then you can install the module. If you want to install newer sfr versions (e.g., 6.x) then higher releases of ASA software would be required as noted in the compatibility guide:

http://www.cisco.com/c/en/us/td/docs/security/asa/compatibility/asamatrx.html#pgfId-137110

Exactly the info and

jwornstaff — Wed, 23 Mar 2016 13:55:06 GMT

Exactly the info and reassurance I was looking for...thanks!

I'm all good on the pre-reqs and compatibility....did plenty of research on that. But understood, some don't and everyone situation is different.

The first task would be to

kbyrd — Wed, 23 Mar 2016 14:48:11 GMT

The first task would be to get IOS to a level that supports both the SSD and sourcefire. I initially upgraded to 9.2.2.4, but I'm now running 9.3.3. Check to make sure compatibility with the legacy IPS.

I don't know if it matters whether you install the SSD first, then remove the legacy IPS, or vice versa. I installed the SSD first in my case.

When you remove the legacy IPS, you will need to reboot the ASA. If you have an HA active/standby pair, that task is non-disruptive.

Then you can load sourcefire.

Good luck.

Re: When you image the module for

devang.savalia — Wed, 28 Feb 2018 17:20:32 GMT

Hi Marvin,

One Question. Do we need 2 SSD for the asa 5545 to have the Firepower Module?

Re: When you image the module for

Mohammed al Baqari — Wed, 28 Feb 2018 17:23:43 GMT

Yes. Without SSDs in ASA55xx you can't run firepower module or FTD.

Re: When you image the module for

devang.savalia — Wed, 28 Feb 2018 17:26:59 GMT

Well Yes!!

Agreed!!

What i meant was, Can i have the Firepower module installed and running with one SSD on ASA5545 Box?